Insufficient Verification of Data Authenticity Affecting deno package, versions >=1.8.0 <1.40.4
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUST-DENO-6405994
- published 7 Mar 2024
- disclosed 6 Mar 2024
- credit easrng
Introduced: 6 Mar 2024
CVE-2024-27932 Open this link in a new tabHow to fix?
Upgrade deno to version 1.40.4 or higher.
Overview
deno is an a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust.
Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity due to improper suffix match testing for DENO_AUTH_TOKENS. An attacker can cause tokens to be sent to servers they shouldn't be sent to by exploiting the way an import specifier's hostname is checked against a token's hostname. This could result in an auth token intended for a specific domain being sent to an unintended domain.